ClawHub
Back to skill

Security audit

SecondMe

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated SecondMe account-management purpose, but it stores a reusable account token and some profile details in a local plaintext credentials file, so users should review it carefully before installing.

Install only if you are comfortable letting this skill access your SecondMe account, make user-confirmed profile and Plaza changes, and create/search SecondMe notes and Key Memory. Keep `{baseDir}/.credentials` private, do not commit or sync it, and prefer logging out or revoking access if the file may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Bearer Token Stored in an Unprotected Plaintext Credentials File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–30 and 104–109
Vulnerability Type: Plaintext storage of a reusable authentication token
Risk Level: Medium

Vulnerable Code

text
**Credentials file:** `{baseDir}/.credentials`

## Shared Authentication Rules

Before any authenticated SecondMe operation:

1. Read `{baseDir}/.credentials`
2. If it contains valid JSON with `accessToken`, continue
3. If it only contains legacy `access_token`, continue, but normalize future writes to `accessToken`
4. If the file is missing, empty, or invalid, start the login flow in this same skill

Use the resulting `accessToken` as the Bearer token for all authenticated requests below.
text
After success:

1. Write `{baseDir}/.credentials`, for example:
   ```json
   {
    "accessToken": "<data.accessToken>",
    "tokenType": "<data.tokenType>"
   }
   ```

Technical Analysis

The skill directs the agent to persist a reusable SecondMe bearer token in a JSON file under its base directory. It does not require owner-only file permissions, ownership validation, encryption, an operating-system credential store, atomic file creation, or protection from version-control and backup exposure.

A bearer token grants access based on possession. Therefore, any process or user able to read this file may replay the token without knowing the account password. The token is subsequently accepted by the documented authenticated SecondMe endpoints.

Attack Path

  1. A victim completes the SecondMe authorization flow.
  2. The skill writes the returned accessToken to {baseDir}/.credentials as plaintext JSON.
  3. A local user, compromised process, permissive backup service, or recipient of an accidentally published project archive reads the credentials file.
  4. The attacker extracts the accessToken.
  5. The attacker submits requests with `Authorization: Bearer <accessToken& ...[truncated 956 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the bearer token in an operating-system keychain, protected credential service, or dedicated secret manager rather than in the project directory.
  2. If file-based storage is unavoidable:
    • Create the file atomically with owner-only permissions such as 0600.
    • Ensure its parent directory is accessible only to the owning user.
    • Validate file ownership and permissions before reading it.
    • Refuse to read symbolic links or files owned by another user.
    • Avoid temporary files containing the token.
  3. Add .credentials to version-control ignore rules and explicitly exclude it from logs, diagnostics, exports, and ordinary backups.
  4. Never display or log the token, authorization header, token-exchange response, or credentials-file contents.
  5. Store only fields required for authentication; do not add profile or unrelated personal data to the credentials file.
  6. On logout, revoke the token through a server-side revocation endpoint when available before securely removing the local credential.
  7. Prefer short-lived access tokens with refresh-token rotation, narrowly scoped permissions, and server-side replay detection where supported.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to read, write, and delete bearer tokens from a local .credentials file, but it never tells the user that credentials will be persisted locally or how that storage is protected. Local token persistence increases the risk of unintended reuse, theft by other local processes or users, and surprise authentication state that the user did not knowingly approve.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prescribes specific Chinese-only introduction and workflow messages for the user, and similar fixed Chinese responses appear throughout the file. This imposes a language choice without documenting that the skill is region-specific or giving the user an option to use another language.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill authorizes drafting profile updates from 'stable information already known from the conversation' and then storing returned profile fields locally, which can cause conversationally supplied personal data to be propagated into external systems and local storage without granular consent. This creates a privacy and data-governance risk because users may share information conversationally without intending it to become durable profile data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

After profile updates, the skill instructs the agent to write additional personal profile fields such as name, homepage, and originRoute into the local credentials file without explicit notice or consent. This expands local retention from authentication secrets to user profile data, increasing privacy risk and making the credentials store a mixed repository of both secrets and personal information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Key Memory section intentionally supports durable storage of personal facts, preferences, and relationship context, which is expected product behavior but still privacy-sensitive. Without explicit per-item consent, retention boundaries, and clear user understanding that data is being stored in an external memory system, the feature can capture sensitive personal information more broadly than the user intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.